Provisioning XML Reference
The declarative file that drives an application's Provisioning Config screens in the App Store — Source connection fields, plus account and group attribute schemas. Every example on this page uses a generic sample connector; swap in your own connection settings and attributes when you author a real one.
Document structure
0
Validation is strict: the schema (source_configuration.xsd) has elementFormDefault="qualified" and permits no undeclared elements — a stray or misspelled element rejects the whole upload, it doesn't just get ignored.
Root element — <Configuration>
| Attribute | Required | Description |
|---|---|---|
| connector | Yes | Identifies which connector JAR this configuration is for, e.g. SampleConnector. Must match the connector's registered name. |
| features | Yes | Comma-separated list of supported operations, e.g. CREATE,UPDATE,DELETE,REMOVE_FROM_GROUP,ADD_TO_GROUP,CHANGE_PASSWORD. Drives which actions the App Store will offer for this application. |
5
<Source> — connection FieldSets
One or more FieldSet blocks group related connection settings — for example a Connection Settings block and a separate Sync Settings block. Each renders as its own section on the application's Provisioning → Source screen.
| Element | Required | Description |
|---|---|---|
| Name | Yes | Internal key the connector reads at runtime, e.g. host. |
| DisplayName | Yes | Label shown to the admin, e.g. "Forest Name". |
| Value | Yes | Default value — usually empty for admin-supplied fields. |
| DataType | Yes | One of STRING, TEXT, TEXTAREA, NUMBER, BOOLEAN, SECRET, LIST, DATETIME. SECRET masks the value in the UI (used for password-type fields). |
| Required | Yes | true/false — enforced on the Source form before Test Connection is allowed to pass. |
| Placeholder | No | Hint text, e.g. hostname.example.com. |
| IsEncrypted | No | Marks the stored value for at-rest encryption. |
| Options | No | Required when DataType=LIST — one or more Option elements, each with a Label and its own ConditionalFields that appear only when that option is selected. |
The authType field below shows the LIST + ConditionalFields pattern: picking Basic reveals a TLS toggle that Token doesn't need.
27
<Attributes> — account & group schemas
Each Attribute block declares the schema for one object kind. type="account" needs an identityAttribute — the field that uniquely identifies an account (e.g. username). type="group" additionally takes groupName and objectType to describe which kind of group it represents.
You're not limited to one type="group" block — Attribute can repeat any number of times under Attributes, so an application with several distinct kinds of groups (for example a standard group and a distribution group) onboards each as its own Attribute type="group" block, each with its own groupName, objectType and field set.
| Element | Required | Description |
|---|---|---|
| Name | Yes | Attribute key in the target system, e.g. groups. |
| DisplayName | No | Label shown in the UI. |
| Type | Yes | One of STRING, NUMBER, BOOLEAN, DATETIME. |
| Description | Yes | Explains what the attribute holds — shown as help text on Attribute Mappings. |
| IsEntitlement | No (account only) | Marks a multi-valued attribute as grantable/certifiable, e.g. groups. |
| IsMultiValued | Yes | Whether the target can return more than one value for this field. |
| IsRequired | Yes | Whether the attribute must always be present for a valid account/group record. |
47
Full example — entire document structure
Everything above assembled into one complete, valid file: two Source field sets (one of them showing the LIST/ConditionalFields pattern), one account Attribute, and two group Attribute blocks. This is the full shape a real provisioning XML takes — copy it as a starting skeleton and replace the sample names with your own.
53
Validation enforced on upload
| Check | What fails it |
|---|---|
| Well-formed XML | Any malformed markup rejects the whole upload before schema validation even runs. |
| XXE hardening | DOCTYPE declarations and external general/parameter entities are rejected outright — you cannot reference external files or entities from the document. |
| Schema conformance | Validated against source_configuration.xsd. Undeclared elements, missing required elements/attributes, or wrong element order under SourceFieldType's <xs:all> all fail validation with the offending element/line reported back. |
| File size | 50 MB maximum. |
| File type | .xml only. |
Uploading it in the App Store
- Open Applications and either Add an Application (new application) or open an existing one and choose Edit.
- Under Application Type, check Provisioning — this reveals the Provisioning XML upload field.
- Choose your
.xmlfile. On a new application it's required; on an existing one that already has a stored file, leaving the upload blank keeps the current XML unchanged. - Save. A schema, XXE, size or type failure returns the form with the specific validation error instead of persisting anything — fix the reported element and resubmit.
- Once saved, open the application's Provisioning Config tabs (Source, Account Attributes, Group Attributes, etc.) and confirm every
FieldSet/Attributeblock rendered the way you expect.